I think that just means they hacked a machine running in the offices, not that they were literally physically on-premises. There's a rather large opaque black h

I think that just means they hacked a machine running in the offices, not that they were literally physically on-premises. There's a rather large opaque black hole in the middle of this assertion: how are the attackers obtaining administrator credentials to the SSO systems? There seems to be a pretty big leap here from "get code inside the firewall via Orion" and "oops, now your SSO ticket private key is pwned". They say administrator credential compromise, OK, that's a pretty general class of techniques. The details would be good because otherwise there seems to be a missing link here.